"Technique ID","Detection Available","Link","score"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml","62"
"T1027","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_create_executable_file.yml","62"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1193","No","-","58"
"T1598.002","No","-","58"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml","54"
"T1204.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/uncommon_processes_on_endpoint.yml","54"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml","37"
"T1566.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml","37"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","53"
"T1105","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml","53"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml","39"
"T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","39"
"T1086","No","-","55"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_force_flag.yml","47"
"T1059.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml","47"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1060","No","-","45"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_persistence.yml","43"
"T1547.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/start_up_during_safe_mode_boot.yml","43"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1071.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml","41"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1598.003","No","-","37"
"T1192","No","-","37"
"T1566.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml","36"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","35"
"T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml","35"
"T1107","No","-","37"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1082","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml","35"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1083","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","34"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","28"
"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","28"
"T1059.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml","34"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml","10"
"T1078","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml","10"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/unsigned_image_loaded_by_lsass.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dump_lsass_via_procdump_rename.yml","21"
"T1003.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml","21"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1036.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","29"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","28"
"T1057","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","28"
"T1016","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml","29"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sqlite_module_in_temp_folder.yml","28"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1204.001","No","-","28"
"T1203","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","27"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discocvery_with_env_vars_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml","17"
"T1033","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml","17"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_with_decode_argument.yml","22"
"T1140","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml","22"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_nltest.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_net.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_dsquery.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaincontroller_with_powershell.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_controller_discovery_with_wmic.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml","10"
"T1018","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml","10"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml","18"
"T1560.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml","18"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1076","No","-","22"
"T1056.001","No","-","22"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","4"
"T1055","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml","4"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml","20"
"T1021.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml","20"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_wmi_command_attempt.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/script_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_execution_via_wmi.yml","17"
"T1047","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","17"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1189","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml","20"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","14"
"T1059","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml","14"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1553.002","No","-","19"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_arp.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_netstat.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/network_connection_discovery_net.yml","14"
"T1049","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml","14"
"T1116","No","-","19"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1133","No","-","18"
"T1074.001","No","-","18"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml","15"
"T1112","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml","15"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1503","No","-","17"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml","13"
"T1543.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml","13"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml","14"
"T1136.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml","14"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml","15"
"T1555.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml","15"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml","3"
"T1003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml","3"
"T1041","No","-","17"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml","6"
"T1087.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml","6"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___system_process_running_unexpected_location.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml","13"
"T1036","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml","13"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml","14"
"T1505.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","14"
"T1046","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","14"
"T1574.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml","15"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml","0"
"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml","0"
"T1073","No","-","16"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml","-1"
"T1087.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml","-1"
"T1085","No","-","16"
"T1136.002","No","-","16"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/write_executable_in_smb_share.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","11"
"T1021.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml","11"
"T1100","No","-","16"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1190","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml","14"
"T1518.001","No","-","15"
"T1119","No","-","15"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","12"
"T1555","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml","12"
"T1043","No","-","15"
"T1584.001","No","-","15"
"T1583.001","No","-","15"
"T1063","No","-","15"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1045","No","-","14"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml","10"
"T1059.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml","10"
"T1027.002","No","-","14"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml","-8"
"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","-8"
"T1036.004","No","-","14"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml","9"
"T1113","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","9"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1219","No","-","12"
"T1102.002","No","-","12"
"T1560","No","-","12"
"T1012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","9"
"T1106","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","9"
"T1571","No","-","11"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml","9"
"T1110","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml","9"
"T1090","No","-","11"
"T1035","No","-","11"
"T1573.001","No","-","11"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_sc_service_utility.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_executed_as_a_service.yml","7"
"T1569.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_psexec.yml","7"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","8"
"T1135","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","8"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml","1"
"T1068","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","1"
"T1059.006","No","-","11"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1143","No","-","10"
"T1124","No","-","10"
"T1173","No","-","10"
"T1588.001","No","-","10"
"T1114.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml","9"
"T1518","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","9"
"T1102","No","-","10"
"T1559.002","No","-","10"
"T1132.001","No","-","10"
"T1564.003","No","-","10"
"T1587.001","No","-","10"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml","-1"
"T1548.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml","-1"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml","6"
"T1218.010","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml","6"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml","7"
"T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","7"
"T1170","No","-","9"
"T1088","No","-","9"
"T1584.006","No","-","9"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml","7"
"T1007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","7"
"T1117","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml","8"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml","7"
"T1078.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml","7"
"T1090.002","No","-","9"
"T1099","No","-","9"
"T1590.002","No","-","9"
"T1583.006","No","-","9"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","1"
"T1218.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml","1"
"T1070.006","No","-","9"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml","3"
"T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","3"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1009","No","-","8"
"T1021.004","No","-","8"
"T1065","No","-","8"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml","4"
"T1070","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml","4"
"T1027.001","No","-","8"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml","6"
"T1562.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml","6"
"T1003.004","No","-","8"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml","6"
"T1027.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml","6"
"T1552.001","No","-","8"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detection_of_dns_tunnels.yml","1"
"T1048.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_long_dns_txt_record_response.yml","1"
"T1066","No","-","8"
"T1074.002","No","-","8"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml","1"
"T1003.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml","1"
"T1137","No","-","8"
"T1078.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml","0"
"T1003.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml","0"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","3"
"T1134","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml","3"
"T1195.002","No","-","7"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","5"
"T1590","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","5"
"T1027.003","No","-","7"
"T1001.002","No","-","7"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml","5"
"T1546.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml","5"
"T1075","No","-","7"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml","3"
"T1550.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_pass_hash.yml","3"
"T1547.009","No","-","7"
"T1570","No","-","7"
"T1194","No","-","7"
"T1023","No","-","7"
"T1069","No","-","7"
"T1071","No","-","7"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml","-8"
"T1098","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml","-8"
"T1566.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml","6"
"T1084","No","-","7"
"T1221","No","-","7"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1550","No","-","6"
"T1037","No","-","6"
"T1015","No","-","6"
"T1090.001","No","-","6"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml","4"
"T1564.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml","4"
"T1546.008","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/overwriting_accessibility_binaries.yml","5"
"T1038","No","-","6"
"T1573.002","No","-","6"
"T1585.002","No","-","6"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1110.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml","-2"
"T1586.002","No","-","6"
"T1120","No","-","6"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml","1"
"T1087","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","1"
"T1574.001","No","-","6"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml","4"
"T1020","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml","4"
"T1158","No","-","6"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml","3"
"T1039","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml","3"
"T1040","No","-","6"
"T1055.001","No","-","6"
"T1589.002","No","-","6"
"T1095","No","-","6"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1499","No","-","5"
"T1218.007","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml","4"
"T1090.003","No","-","5"
"T1028","No","-","5"
"T1210","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml","4"
"T1056","No","-","5"
"T1566","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml","4"
"T1213","No","-","5"
"T1071.003","No","-","5"
"T1568","No","-","5"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml","1"
"T1218.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml","1"
"T1587","No","-","5"
"T1001","No","-","5"
"T1583.004","No","-","5"
"T1598","No","-","5"
"T1102.001","No","-","5"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_net.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getadgroup_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_adsisearcher.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_wmic.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/elevated_group_discovery_with_powerview.yml","-13"
"T1069.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_group_discovery_with_dsquery.yml","-13"
"T1572","No","-","5"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_wmiobject_group_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_localgroup_discovery.yml","-6"
"T1069.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-6"
"T1567.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_drive_share_in_external_email.yml","4"
"T1188","No","-","5"
"T1021.006","No","-","5"
"T1560.003","No","-","5"
"T1584.004","No","-","5"
"T1223","No","-","5"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1208","No","-","4"
"T1587.003","No","-","4"
"T1585","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml","3"
"T1497","No","-","4"
"T1003.005","No","-","4"
"T1588.002","No","-","4"
"T1008","No","-","4"
"T1114","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml","3"
"T1110.002","No","-","4"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_kerberoasting.yml","2"
"T1558.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","2"
"T1091","No","-","4"
"T1585.001","No","-","4"
"T1596.003","No","-","4"
"T1093","No","-","4"
"T1487","No","-","4"
"T1561.002","No","-","4"
"T1094","No","-","4"
"T1055.012","No","-","4"
"T1589","No","-","4"
"T1496","No","-","4"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_start_bitstransfer.yml","1"
"T1197","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/bits_job_persistence.yml","1"
"T1586.001","No","-","4"
"T1014","No","-","4"
"T1145","No","-","4"
"T1552.004","No","-","4"
"T1071.002","No","-","4"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_in_develop.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/github_commit_changes_in_master.yml","1"
"T1199","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","1"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ransomware_notes_bulk_creation.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_process_termination_frequency.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_test_files_detected.yml","-2"
"T1486","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/samsam_test_file_write.yml","-2"
"T1588.004","No","-","4"
"T1036.002","No","-","4"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1067","No","-","3"
"T1097","No","-","3"
"T1547.004","No","-","3"
"T1550.003","No","-","3"
"T1003.006","No","-","3"
"T1595.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","2"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml","0"
"T1485","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/high_file_deletion_frequency.yml","0"
"T1593","No","-","3"
"T1529","No","-","3"
"T1555.004","No","-","3"
"T1589.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","2"
"T1588.003","No","-","3"
"T1004","No","-","3"
"T1557","No","-","3"
"T1587.002","No","-","3"
"T1213.002","No","-","3"
"T1025","No","-","3"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/password_policy_discovery_with_net.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml","-5"
"T1201","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml","-5"
"T1567","No","-","3"
"T1583.003","No","-","3"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml","-4"
"T1036.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/execution_of_file_with_spaces_before_extension.yml","-4"
"T1497.001","No","-","3"
"T1016.001","No","-","3"
"T1542.003","No","-","3"
"T1498","No","-","3"
"T1584.003","No","-","3"
"T1573","No","-","3"
"T1074","No","-","3"
"T1114.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml","2"
"T1080","No","-","3"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domaintrust_with_powershell.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/nltest_domain_trust_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/dsquery_domain_discovery.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml","-9"
"T1482","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell.yml","-9"
"T1098.002","No","-","3"
"T1562.002","No","-","3"
"T1104","No","-","3"
"T1072","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml","2"
"T1027.004","No","-","3"
"T1115","No","-","3"
"T1053.002","No","-","3"
"T1500","No","-","3"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1484.002","No","-","2"
"T1176","No","-","2"
"T1506","No","-","2"
"T1542.002","No","-","2"
"T1052.001","No","-","2"
"T1553.006","No","-","2"
"T1098.001","No","-","2"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_delete_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___resize_shadowstorage_volume.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___delete_a_net_user.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempt_to_disable_services.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___disable_net_user_account.yml","-6"
"T1489","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml","-6"
"T1032","No","-","2"
"T1111","No","-","2"
"T1087.003","No","-","2"
"T1134.002","No","-","2"
"T1109","No","-","2"
"T1220","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml","1"
"T1550.004","No","-","2"
"T1480.001","No","-","2"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml","0"
"T1114.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml","0"
"T1118","No","-","2"
"T1222.002","No","-","2"
"T1564.005","No","-","2"
"T1608.004","No","-","2"
"T1606.001","No","-","2"
"T1187","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_network_share_access_request.yml","1"
"T1574.006","No","-","2"
"T1125","No","-","2"
"T1560.002","No","-","2"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml","-1"
"T1218.003","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml","-1"
"T1055.002","No","-","2"
"T1555.005","No","-","2"
"T1568.002","No","-","2"
"T1483","No","-","2"
"T1565.001","No","-","2"
"T1606.002","No","-","2"
"T1191","No","-","2"
"T1059.004","No","-","2"
"T1589.003","No","-","2"
"T1497.002","No","-","2"
"T1037.001","No","-","2"
"T1217","No","-","2"
"T1559.001","No","-","2"
"T1048.002","No","-","2"
"T1001.003","No","-","2"
"T1036.001","No","-","2"
"T1492","No","-","2"
"T1594","No","-","2"
"T1021.005","No","-","2"
"T1568.001","No","-","2"
"T1218.004","No","-","2"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"
"T1056.002","No","-","1"
"T1186","No","-","1"
"T1103","No","-","1"
"T1055.013","No","-","1"
"T1096","No","-","1"
"T1484.001","No","-","1"
"T1216.001","No","-","1"
"T1491.001","No","-","1"
"T1070.003","No","-","1"
"T1608.005","No","-","1"
"T1070.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml","0"
"T1030","No","-","1"
"T1174","No","-","1"
"T1102.003","No","-","1"
"T1122","No","-","1"
"T1534","No","-","1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets.yml","-1"
"T1530","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml","-1"
"T1557.002","No","-","1"
"T1550.001","No","-","1"
"T1543.002","No","-","1"
"T1556.001","No","-","1"
"T1090.004","No","-","1"
"T1561.001","No","-","1"
"T1528","No","-","1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_defaultuser_and_password_in_registry.yml","-1"
"T1552.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/auto_admin_logon_registry_entry.yml","-1"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_file_creation.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml","-2"
"T1546.011","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml","-2"
"T1101","No","-","1"
"T1546.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_changes_to_file_associations.yml","0"
"T1493","No","-","1"
"T1110.001","No","-","1"
"T1137.002","No","-","1"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_spawn.yml","-2"
"T1127.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml","-2"
"T1137.001","No","-","1"
"T1501","No","-","1"
"T1491.002","No","-","1"
"T1546.015","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml","0"
"T1001.001","No","-","1"
"T1218.008","No","-","1"
"T1172","No","-","1"
"T1527","No","-","1"
"T1565.002","No","-","1"
"T1588.006","No","-","1"
"T1608.001","No","-","1"
"T1183","No","-","1"
"T1123","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml","0"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml","-1"
"T1592.002","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml","-1"
"T1010","No","-","1"
"T1029","No","-","1"
"T1547.005","No","-","1"
"T1134.001","No","-","1"
"T1138","No","-","1"
"T1592.004","No","-","1"
"T1488","No","-","1"
"T1590.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml","0"
"T1590.005","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml","0"
"T1092","No","-","1"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml","-16"
"T1078.004","Yes","https://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml","-16"
"T1539","No","-","1"
"T1042","No","-","1"
"T1222.001","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml","0"
"T1557.001","No","-","1"
"T1608.002","No","-","1"
"T1574.012","No","-","1"
"T1182","No","-","1"
"T1026","No","-","1"
"T1556.002","No","-","1"
"T1591.002","No","-","1"
"T1568.003","No","-","1"
"T1553.005","No","-","1"
"T1126","No","-","1"
"T1546.009","No","-","1"
"T1053.003","No","-","1"
"T1546.013","No","-","1"
"T1137.006","No","-","1"
"T1214","No","-","1"
"T1110.004","No","-","1"
"T1070.002","No","-","1"
"T1546.010","No","-","1"
"T1205.001","No","-","1"
"T1565.003","No","-","1"
"T1137.004","No","-","1"
"T1494","No","-","1"
"T1552.006","No","-","1"
"T1546.012","Yes","https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml","0"
"T1146","No","-","1"
"T1564.004","No","-","1"
"T1558.001","No","-","1"
"T1200","No","-","1"
"T1504","No","-","1"
"T1056.004","No","-","1"
"T1211","No","-","1"